# Ahold Delhaize October 2026 cyberattack disrupts Benelux/US online and supply chain; Q4 sales hit €200–250M · pwn.watch > On Oct 12 2026 Ahold Delhaize detected a cybersecurity issue in its IT infrastructure and took systems offline as a precaution. Brands' physical stores stayed open, but websites, apps and e-commerce were disrupted across parts of Europe and the United States, along with Benelux supply-chain operations; Bol was not impacted. On Oct 19 the company said the activity was malicious, that it had notified the Dutch NCSC within 24 hours, filed a police report, and had no evidence at that time of sensitive customer, associate or partner data theft. In its Nov 4 Q3 2026 results, Ahold Delhaize estimated the incident will cut Q4 net sales by €200–250 million and underlying/IFRS operating income by €75–100 million, and lowered full-year guidance; CEO Frans Muller said most disruption was contained within two weeks while full restoration continues. Attack type has not been publicly disclosed. Dutch NCSC saw no reason to link this IT outage to the separate European supermarket refrigeration-controller campaign. Page: https://pwn.watch/i/ahold-delhaize-october-2026-cyberattack · generated 2026-11-06T17:04:01.956Z ## Status - Severity: high · status: live · patch: partial - Product: Ahold Delhaize group IT / brand e-commerce and Benelux supply-chain systems (Albert Heijn, Delhaize, Food Lion, Hannaford and other brands); Bol not impacted - Started: 2026-10-12 - Affected: Ahold Delhaize brand websites/apps and related IT systems in Benelux and the U.S.; Benelux supply-chain operations (exact systems not publicly detailed) - Fixed in: No public technical patch: phased restoration; company says most disruption contained within about two weeks as of Nov 4 2026 guidance update, with work continuing to fully restore normal operations ## Follow this incident - RSS (one item per update): https://pwn.watch/i/ahold-delhaize-october-2026-cyberattack/feed.xml - JSON Feed: https://pwn.watch/i/ahold-delhaize-october-2026-cyberattack/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ahold-delhaize-october-2026-cyberattack.json - This file: https://pwn.watch/i/ahold-delhaize-october-2026-cyberattack/llms.txt ## Updates (newest first) - 2026-11-06: SecurityWeek covers Ahold Delhaize's estimate of the financial toll of the October cyberattack. (https://www.securityweek.com/grocery-giant-ahold-delhaize-estimates-financial-toll-of-october-cyberattack/) - 2026-11-04: Q3 results: estimates Q4 net sales reduced by €200–250M and underlying/IFRS operating income by €75–100M due to the October cyberattack; full-year guidance cut; Muller says most disruption contained within two weeks while restoration continues. (https://newsroom.aholddelhaize.com/ahold-delhaize-reports-resilient-q3-2026-results-and-updates-2026-guidance-to-reflect-business-disruption-caused-by-recent-cybersecurity-incident/) - 2026-10-19: Company update: investigation confirms malicious actions; Dutch NCSC notified within 24 hours; formal police report filed; no evidence at that time of sensitive data theft; phased restoration of sites and apps underway. (https://newsroom.aholddelhaize.com/ahold-delhaize-update-on-status-of-cybersecurity-incident/) - 2026-10-12: Ahold Delhaize says it is experiencing a security issue in its network and takes some systems offline as a precaution; stores remain open. (https://newsroom.aholddelhaize.com/update-on-ahold-delhaizes-cybersecurity-incident/) ## Fix brief # Security brief: Ahold Delhaize October 2026 cyberattack disrupts Benelux/US online and supply chain; Q4 sales hit €200–250M Source: https://pwn.watch/i/ahold-delhaize-october-2026-cyberattack · status: live · severity: high · updated Nov 6, 2026, 14:10 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Oct 12 2026 Ahold Delhaize detected a cybersecurity issue in its IT infrastructure and took systems offline as a precaution. Brands' physical stores stayed open, but websites, apps and e-commerce were disrupted across parts of Europe and the United States, along with Benelux supply-chain operations; Bol was not impacted. On Oct 19 the company said the activity was malicious, that it had notified the Dutch NCSC within 24 hours, filed a police report, and had no evidence at that time of sensitive customer, associate or partner data theft. In its Nov 4 Q3 2026 results, Ahold Delhaize estimated the incident will cut Q4 net sales by €200–250 million and underlying/IFRS operating income by €75–100 million, and lowered full-year guidance; CEO Frans Muller said most disruption was contained within two weeks while full restoration continues. Attack type has not been publicly disclosed. Dutch NCSC saw no reason to link this IT outage to the separate European supermarket refrigeration-controller campaign. Severity detail: Major multinational grocery IT disruption with hundreds of millions of euros in expected Q4 sales/income impact; stores stayed open; no public confirmation of data theft as of Oct 19 - Product: Ahold Delhaize group IT / brand e-commerce and Benelux supply-chain systems (Albert Heijn, Delhaize, Food Lion, Hannaford and other brands); Bol not impacted ## Affected versions - Ahold Delhaize brand websites/apps and related IT systems in Benelux and the U.S.; Benelux supply-chain operations (exact systems not publicly detailed) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - No public technical patch: phased restoration; company says most disruption contained within about two weeks as of Nov 4 2026 guidance update, with work continuing to fully restore normal operations After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes Related tracked wave (do not merge): french-supermarket-refrigeration-controller-attacks. ## Latest updates - Nov 6, 2026: SecurityWeek covers Ahold Delhaize's estimate of the financial toll of the October cyberattack. - Nov 4, 2026: Q3 results: estimates Q4 net sales reduced by €200–250M and underlying/IFRS operating income by €75–100M due to the October cyberattack; full-year guidance cut; Muller says most disruption contained within two weeks while restoration continues. - Oct 19, 2026: Company update: investigation confirms malicious actions; Dutch NCSC notified within 24 hours; formal police report filed; no evidence at that time of sensitive data theft; phased restoration of sites and apps underway. - Oct 12, 2026: Ahold Delhaize says it is experiencing a security issue in its network and takes some systems offline as a precaution; stores remain open. ## Advisories - [Update on Ahold Delhaize's cybersecurity incident](https://newsroom.aholddelhaize.com/update-on-ahold-delhaizes-cybersecurity-incident/) (Ahold Delhaize) - [Ahold Delhaize update on status of cybersecurity incident](https://newsroom.aholddelhaize.com/ahold-delhaize-update-on-status-of-cybersecurity-incident/) (Ahold Delhaize) - [Q3 2026 results and guidance update reflecting cybersecurity incident](https://newsroom.aholddelhaize.com/ahold-delhaize-reports-resilient-q3-2026-results-and-updates-2026-guidance-to-reflect-business-disruption-caused-by-recent-cybersecurity-incident/) (Ahold Delhaize) ## Write-ups & news - [Grocery Giant Ahold Delhaize Estimates Financial Toll of October Cyberattack](https://www.securityweek.com/grocery-giant-ahold-delhaize-estimates-financial-toll-of-october-cyberattack/) ## Caveats Separate from french-supermarket-refrigeration-controller-attacks; Dutch NCSC saw no reason to link the Albert Heijn / Ahold Delhaize IT outage to the refrigeration campaign. Attack type not publicly disclosed. --- Machine-readable: https://pwn.watch/i/ahold-delhaize-october-2026-cyberattack.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.